How to balance data privacy with employee well-being when mental health issues arise: Joe Kirk

Many people assume they cannot share any health-related information without the individual's consent, but this is not the case.

The Information Commissioner’s Office (ICO) recently issued new guidance on data sharing in mental health emergencies. Symptoms of mental health emergencies vary from person to person, making it difficult to determine when a situation becomes an emergency.

According to the guidance, data protection laws permit organisations to share personal information in urgent or emergency situations, including those aimed at preventing loss of life or serious physical, emotional, or mental harm. In such emergencies, it's crucial to share health information as necessary and proportionate.

Recognising a mental health emergency or crisis can be more challenging than identifying a physical health emergency. Therefore, this guidance comes at an opportune time to assist organisations in understanding what information they can share in these critical situations, but still, there are some challenging areas.

The issue of vital interest is notable. The new guidance suggests that personal data cannot be used if a worker is capable of giving consent, which appears contradictory. In my understanding of consent and individuals with diminished mental capacity, it's unlikely that consent can be considered freely given and fully understood.

This condition typically applies in matters of life and death. However, if you cannot use this basis if the worker is capable of giving consent, then the second potential lawful basis is legitimate interest.

This basis implies that it may only apply if there's a compelling reason to protect the worker's personal information, which either outweighs your interests or the interests of a third party.

Consent issues can be daunting, but it's essential to weigh the situation against the potential consequences for the individual involved. For instance, if it's not a matter of life and death and the situation is less severe, relying on consent becomes pivotal.

However, if the individual declines consent, there's little recourse but to refrain from sharing information. In such cases, respecting the individual's decision is paramount, even if it limits the actions that can be taken.

You never know when a mental health emergency will take place, but having the right guidance in place can make all the difference. By establishing clear policies and providing concise instructions to employees on sharing information during such emergencies, you can ensure that privacy laws are upheld while addressing urgent situations effectively.

Proactive planning empowers staff to make informed decisions swiftly, fostering a culture of support and understanding in handling mental health crises. This approach not only protects individuals' privacy but also promotes a safer and more supportive workplace environment for all.

Joe Kirk is an Account Manager for Data Protection People